Two months after launch we hired an ethical hacker. He found two critical flaws. The worst was a conversation ID exposed in the front-end that gave access to another customer's data. The lesson is not about IDOR.
We went from writing straight to the database to RabbitMQ, and from RabbitMQ to a queue inside Postgres itself. The change that mattered was not the technology: it was deciding to store the raw payload before processing it.
Ingestion stopped in the middle of the night. Nine of our ten WhatsApp numbers had been banned at once. In two months we moved 100% of the operation from Bubble to Next.js + Supabase — and pivoted the product along the way.
An agent doesn't call your API because it read the code — it reads the description and decides. That's why every tool is a contract: what it does, inputs, outputs, errors, whether it's reversible, and whether it needs approval.
Before you write a single prompt, an agent demands 7 design decisions — the same 7 that separate a reliable agent from a good-looking demo.
The practical difference between chatbots and AI agents, and why that distinction changes architecture, product, risk, and operations.
We use cookies to understand how the site is used and to improve your experience. You can accept or reject. Privacy policy
